Privacy Policy

Last updated: 16 October 2026

1. Who we are

MSYN Tech (“MSYN”, “we”, “us” or “our”) provides software for document collection, site workflows and API design. For questions about your information, contact privacy@msyntech.com.

2. Scope

This policy covers website enquiries, account and workspace records, files submitted through collection workflows, API Designer projects and connected services. Your organization decides what business and client information to submit and who may access it. For requests concerning a document held by an organization, contact that organization as well as MSYN where appropriate.

3. Information we collect

We collect the details you submit, such as your name, organization, email, phone number, role, pilot application and feedback. We process workspace membership, settings, project requirements, uploaded files, generated outputs and recorded service activity. Technical records may include IP addresses, browser details and security logs. Google sign-in provides a verified account identifier, name and email; it does not by itself grant access to Gmail or Drive. Those connections require separate authorization.

Connected Google services provide authorization tokens and the account, message, attachment or file information needed for the features you authorize. MSYN's use of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements. We do not use that information for advertising or to train general-purpose AI models. Connecting WhatsApp Business provides account and phone-number identifiers, a display number and an authorization token. Saved integration tokens are encrypted. WhatsApp collection processes new supported image and document attachments; it does not import historical chats or message text.

4. Why we use information

We use information to create and administer accounts and workspaces, provide document-request and collection services, operate integrations explicitly connected by workspace administrators, communicate with users, improve and protect the service, prevent misuse, maintain business records, and comply with legal requirements.

5. Consent and choices

You choose whether to connect third-party accounts or authorize external AI processing. Where we rely on consent, you can withdraw it by contacting us or using the relevant service controls. You can ask to stop marketing messages; we may still send account, security and service notices.

6. How we share information

We do not sell personal data. We use providers for hosting, storage, email and other service functions. Cloudflare R2 stores application files, while connected Google Drive can store supported collection uploads. Google and Meta process authorized integration activity under their own terms. Where document analysis is enabled, extracted text or supported document content may be sent to configured AI services for that feature. When you authorize external processing in API Designer, selected requirements and reference-file content may be sent to configured AI providers. Generated responses and files are retained for previews, retries and downloads. Credentials and raw AI responses are not intended for public access; automated redaction is not a guarantee that every secret will be detected. Do not submit live API keys or information you are not authorized to share.

7. Client documents & confidentiality

Clients can submit files through private request links. Authorized workspace users may import Gmail attachments or collect supported attachments from a connected WhatsApp Business number. Current storage options are Cloudflare R2 and supported Google Drive collection storage. Additional providers may be introduced in future; their data access, security and retention arrangements will be described when offered. Future integration plans do not authorize access to accounts you have not connected. Supported files are routed to their configured destination; changing that destination does not automatically migrate existing files. Drive access uses the drive.file scope, and MSYN checks workspace markers, private-owner permissions and file checksums for supported stored originals. Files remain subject to the selected provider's account controls and policies. Private request links and short-lived download links grant access while valid, so recipients must not forward them to unauthorized people. The workspace is responsible for its collection instructions, notices and permissions.

8. Data retention

We retain account records, documents and generated outputs as needed to provide the service, meet legal and security requirements and follow applicable agreements. Uploads may be written to server-side temporary or quarantine files during validation, scanning or analysis. Failed or deferred work may retain a temporary copy for retry; cleanup and supported storage deletions can be queued and retried if a provider is unavailable. Deletion is therefore not always immediate, and backup copies or provider-retained records may follow separate retention rules. Disconnecting an integration stops future use of its saved connection but does not delete previously collected files, move them to another provider or necessarily revoke provider-side authorization. Contact us about deletion or residency requirements before submitting restricted data.

9. Security safeguards

MSYN uses server-side workspace permissions, HTTPS production API connections, Argon2 password hashing for new passwords, rotating sessions and AES-256-GCM encryption for saved integration credentials. Cloudflare provides AES-256 encryption at rest for R2 objects; connected Drive files are subject to Google's encryption and account controls. Application download permissions and short-lived links limit file delivery. Temporary processing files, databases and backups are separate from object-storage encryption, and we do not promise end-to-end encryption across the service. Scanner-dependent protections require an operational configured scanner. No control eliminates every risk, and no independent certification is implied. See our Security and document handling information.

10. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal information, or withdraw consent. To exercise your rights, email us at privacy@msyntech.com.

11. Cookies and tracking

The application uses cookies and browser storage for sign-in, security and preferences. Google sign-in, Meta authorization and embedded YouTube videos may receive browser information and use their own storage. See our Cookies Policy for details.

12. Changes to this policy

We may update this policy as the service or legal requirements change. We will update the date above when we publish a revision. Where required, we will provide additional notice or obtain consent for material changes.

13. Contact

Send privacy questions and requests to privacy@msyntech.com. For account or product help, contact support@msyntech.com.